CODEWITHSUNDEEP
processhookcode-injectiondll-injection
dzima
dzima

Reputation: 23

Hooking to the windows process

I need to perform some operations just after the applications starts and right before it quits (some kind of automated memory leaks detection using UMDH).

I've prepared DLL, that is injected to all process and on DLL_PROCESS_ATTACH I'm performing my first operation (just after the application starts) - so this part of my problem is solved.

Problem is with the second part - perform the operation when the process is about to exit.

I've tried it in DLL_PROCESS_DETACH, but this is too late, i need to hook earlier.

Using Windows Hooks mechanism, I've hooked on the WH_GETMESSAGE:

hhk = SetWindowsHookEx(WH_GETMESSAGE, (HOOKPROC) &GetMsgProc, NULL , GetCurrentThreadId());

And GetMsgProc() function:

LRESULT CALLBACK GetMsgProc(int nCode,WPARAM wParam,LPARAM lParam)
{
  if( nCode == HC_ACTION )
  {
        PMSG msg = (PMSG) lParam;
        if( msg->message == WM_CLOSE )
        {
              OutputDebugString(L"WM_CLOSE");
        }
        if( msg->message == WM_QUIT )
        {
              OutputDebugString(L"WM_QUIT");
        }
        if( msg->message == WM_DESTROY )
        {
              OutputDebugString(L"WM_DESTROY");
        }
  }
  return CallNextHookEx(hhk, nCode, wParam, lParam);
}

But using this method, I'm detecting only WM_CLOSE message (when I will close the application using "X" button). I don't know why I'm not detecting WM_QUIT message, never.

Any ideas, how to perform some operations when application is about to quit?

(I know about Detours, but can't use them in my project...)

Upvotes: 1

Views: 1661

Answers (1)

Maximus
Maximus

Reputation: 10845

  1. Try WH_CALLWNDPROC in addition to WH_GETMESSAGE. So, when you receive WM_DESTROY for the main app window - this may be a flag.

  2. I think, ideally you must override window procedure of main app window (if it is possible). Smth like

  3. WM_QUIT message is not processed by window procedure. When GetMessage see WM_QUIT it returns FALSE. So, may be this is the problem. You may try to change IAT table (imports) to override GetMessage[A/W] procedures.

    WNDPROC gpfnOldProc = (WNDPROC)SetWindowLongPtr(hWnd, GWLP_WNDPROC, (LONG_PTR)YourWndProc);

Upvotes: 1

Related Questions